---
id: CVE-2026-112947
aliases:
  - GHSA-vfpm-58rq-9qcg
title: >-
  Vite: First 4 bytes of files outside of `server.fs` setting is exposed by
  `?vite-wasm-instance`
summary: >-
  Vite: First 4 bytes of files outside of `server.fs` setting is exposed by
  `?vite-wasm-instance`
severity: medium
cvss: 6.3
cwe:
  - CWE-22
  - CWE-200
  - CWE-209
vendor: vite
product: vite
ecosystem: npm
affected:
  - 'vite >= 8.3.0, <= 8.3.2'
  - 'vite >= 8.2.0, <= 8.2.3'
  - 'vite-plus >= 0.2.8, <= 1.0.0'
patched:
  - vite 8.3.3
  - vite 8.2.4
  - vite-plus 1.1.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T16:47:16Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-vfpm-58rq-9qcg'
references:
  - url: 'https://github.com/vitejs/vite/security/advisories/GHSA-vfpm-58rq-9qcg'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-112947'
  - url: 'https://github.com/vitejs/vite/pull/23655'
  - url: >-
      https://github.com/vitejs/vite/commit/b6c6d2fb3f853aab4092dc25f0d6816a96c23dff
  - url: >-
      https://github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73
  - url: 'https://github.com/advisories/GHSA-vfpm-58rq-9qcg'
tags:
  - ghsa
  - npm
  - cve.org
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-21T14:24:23.584105Z'
cvssSource: cna
epss: 0.00502
epssPercentile: 0.43103
ingestedAt: '2026-10-20T16:10:53.330Z'
---

## Overview

### Summary

The first 4 bytes of files outside of `server.fs` setting can be returned to the browser by a request containing `?vite-wasm-instance`.

### Impact

 Only apps that match one of the following conditions are affected:

- explicitly expose the Vite dev server to the network using `--host` or the [`server.host`](https://vite.dev/config/server-options#server-host) option
- there's a file that has a sensitive information in **the first 4 bytes**
- uses Node.js or Deno to run Vite (if Bun is used, it is not affected)

### Details
Requests containing the `?vite-wasm-instance` query are handled by the internal Wasm plugin's `load` hook. The hook removes the query and reads the resulting path directly from disk, but the `server.fs` checks were not applied.

After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file.

### PoC

Create a denied file and start an affected Vite dev server:

```bash
echo 'SECRET_KEY=abc123\n' > .env
npm run dev
curl 'http://localhost:5173/.env?vite-wasm-instance'
```

This will show
```
Failed to parse WASM file "<root>/.env": WebAssembly.compile(): expected magic word 00 61 73 6d, found 53 45 43 52 @+0
```

## Affected packages

- `vite >= 8.3.0, <= 8.3.2`
- `vite >= 8.2.0, <= 8.2.3`
- `vite-plus >= 0.2.8, <= 1.0.0`

## Remediation

Upgrade to a patched release:

- `vite 8.3.3`
- `vite 8.2.4`
- `vite-plus 1.1.0`